From: Liptz, Chuck 


(b) (2) 



Liptz, Chuck 

(b) (6) 



To: 


Subject: FW: MySSA - Unable to Activate Acct (SD10704993)/IM10384691 


iCoordinators: 

Just wanted to let you all know about this MySSA issue and that it is scheduled to be 
fixed in the September 2013 release. 

Chuck Liptz 

Senior Advisor 

IM Executive Producer 

Off ice of Electronic Services 
Social Security Administration 


(b) (6) 


g tiline 


(b) (6) 


From:_ 

Se nt: Friday, May 03, 2013 9:18 AM 

Cc: Chuck;_ 

Subject: RE: MySSA - Unable to Activate Acct (SD10704993)/IM10384691 


(b) (6) 









Thanks, 



Social Security Administration 


(b) (6) 


From:l 

Sent: Friday. May 03. 2013 8:41 AM 


To: 

id 

|(b) (6) 

(b) (6) 


Kb) 

(b) 




Liptz, Chuck; 


(b) (6) 


Subject: RE: MySSA - Unable to Activate Acct (SD10704993)/IM10384691 


This defect is related to the issue of conflicting BSO/ERE/GSO user IDs. 

The user ID that the user attempted to create is in use by another application. The user can register with 
another user ID. 

This issue will be fixed in the September 2013 Maintenance release. 


(b) (6) 


DCS/OSES/DASSD 


(b) (6) 



Liptz, Chuck; 


(b) (6) 


Subject: MySSA - Unable to Activate Acct (SD10704993)/IM10384691 


Good Afternoon, 

Customer received message, "System not available, try again during normal hours", while 
attempting to activate account. He went into the FO to register and received very 
specific instructions and the notice with the activation code. Please investigate and 
advise. Interaction has been escalated to IM10384691, branch 250. Thank you. 


(b) (6) 


MSST Helpdesk 














(b) (6) 


MySSA - Registration Issue (SD10704993) 

A non-beneficiary continues to have problems while registering for a mySocialSecurity.gov 
account. He registered in person at the FO. He accesses the special URL on the notice given 
to him by the FO. He enters the codes, etc, but gets "System not available." He does use a PO 
Box as his mailing address and the FO answered No to the question about sharing his address 
with Experian. 


(b) (6) 


********************************************************************* 


(b) (6) 


(b) (6) 


_J SSN: | 

4/11/2013 at approx. 1:45pm 


•Affected person’s name and Social Security Number ■ 

•The date and time (including time zone) the problem occurred; 

(eastern standard) 

•The online service where the problem occurred; - www.ssa.gov 

•A description of the error message received; - “System not available, try again during 
normal hours” 

•The name of the screen or field that generated the error message; - The message appears 
on the 3rd step of the create an online account page. (3rd step asks for name, SSN, DOB, 
and 1-time activation code.) 

•The Internet browser and version the reporter used (e.g. Internet Explorer, Netscape, Firefox, 
Netscape, Google Chrome); - Internet Explorer 

•The operating system the reporter using when the problem occurred (e.g. Windows XP, 
Windows 7) - Windows XP 

************************************************************************************************************* 


***************************** 







COMMITTEE ON WAYS AND MEANS 

U.S. HOUSE OF REPRESENTATIVES 
WASHINGTON, DC 20515 


October 13, 2016 


The Honorable Carolyn Colvin 
Acting Commissioner 
Social Security Administration 
6401 Security Boulevard 
Baltimore, MD 21235 

Dear Acting Commissioner Colvin: 

In light of a recent Social Security Administration (SSA) Inspector General (IG) report that has 
raised serious concerns about the security of the mySocialSecurity web-portal, we are writing to 
gain a better understanding of how the SSA protects Americans’ personal information. The 
mySocialSecurity web-portal provides access to some of Americans’ most sensitive information 
including Social Security Numbers, dates of birth, and earnings information, and Americans deserve 
to have this information protected. 

In response to the July 2015 letter sent by then Chairman Ryan, Chairman Johnson, Chairman 
Roskam, and Chairman Boustany regarding the security of mySocialSecurity , you assured the 
Committee that mySocialSecurity “fully meets, and in some ways exceeds, the eAuthentication 
standards established by the Office of Management and Budget (OMB) and the National Institute of 
Standards and Technology (NIST).” However, the recently released SSA IG report found that the 
SSA’s security standards for accessing mySocialSecurity were not only inadequate by NIST 
standards, but also failed to safeguard Federal tax information in accordance with Federal laws and 
the requirements established by the Internal Revenue Service (IRS). We need to understand how 
both assessments can be accurate. 

With that in mind, we would like your response to the following questions: 

• If the SSA was fully meeting the eAuthentication standards set by OMB and NIST, why did 
the IG find the security standards for mySocialSecurity to be inadequate in accordance with 
Federal law, NIST standards, and IRS requirements? 

• What steps are you taking to ensure that the Federal tax information accessible through 
mySocialSecurity is safeguarded according to the standards established by the IRS and other 
applicable Federal law? 

• The IG report found that, despite OMB’s recommending that annual risk assessments be 
conducted, prior to June 2016 the SSA had not conducted a risk assessment for 
mySocialSecurity since 2011. Why did the SSA fail to review its authentication risk 
assessment of mySocialSecurity between 2011 and 2016? 



The American people rightfully expect that their personal information is secure. The SSA has the 
responsibility to make sure this information is protected and to follow the standards established by 
law and the relevant Federal agencies. Thank you for your prompt attention to this matter, we look 
forward to receiving your response by October 27, 2016. If you have any questions concerning this 
request, please contact Amy Shuart, the Social Security Subcommittee Staff Director, at (202) 225- 
9263. 


Sincerely, 








Sam Johnson 
Chairman 

Subcommittee on Social Security 



Subcommittee on Human Resources 



Peter Roskam 
Chairman 

Subcommittee on Oversight 
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6401 Security Boulevard 
Baltimore, MD 21235 
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KEVIN BRADY, TEXAS, 
CHAIRMAN 

SAM JOHNSON, TEXAS 

DEVIN NUNES, CALIFORNIA 

PATRICK J. TIBERI, OHIO 

DAVID G. REICHERT, WASHINGTON 

PETER J. ROSKAM, ILLINOIS 

VERN BUCHANAN. FLORIDA 

ADRIAN SMITH, NEBfv SKA 

LYNN JENKINS. KANSAS 

ERIK PAULSEN, MINNESOTA 

KENNY MARCHANT. TEXAS 

DIANE BLACK, TENNESSEE 

TOM REED, NEW YORK 

MIKE KELLY, PENNSYLVANIA 

JIM RENACCI, OHIO 

PATRICK MEEHAN, PENNSYLVANIA 

KRISTI NOEM, SOUTH DAKOTA 

GEORGE HOLDING. NORTH CAROLINA 

JASON SMITH, MISSOURI 

TOM RICE, SOUTH CAROLINA 

DA'. ID SCHWEIKERT, ARIZONA 

JACKIE WALORSKI, INDIANA 

CARLOS CURBELO, FLORIDA 

MIKE BISHOP, MICHIGAN 


DAVID STEWART, 

STAFF DIRECTOR 

Nancy Berryhill 
Acting Commissioner 
Social Security Administration 
6401 Security Boulevard 
Baltimore, MD 21235 

Dear Acting Commissioner Berryhill: 


I am writing to express my serious concern that the Social Security Administration (SSA) has not 
addressed the security concerns raised in Office of Inspector General’s (OIG’s) September 2016 
report about the SSA’s mySocialSecurity portal, despite previous assurances. 


The September 2016 OIG report raised a number of concerns related to the security standards the 
SSA uses for providing access to mySocialSecurity, particularly with regard to multi-factor 
authentication (MFA). In a letter dated December 22, 2016, then Acting Commissioner Colvin 
assured Chairmen Brady, Buchanan, Roskam, and I that the agency was addressing the OIG’s 
findings. 


This week, I was extremely disappointed to learn from the OIG that the concerns raised in the 
September 2016 report still remain. This is unacceptable, especially considering the June 10, 
2017 roll out includes additional services and expands the groups that can use the 
mySocialSecurity portal. Expanding the services and users while doing nothing to address 
known security concerns is down right reckless. While the rollout of mandatory MFA may 
provide additional security, the OIG has raised important concerns regarding how identities are 
verified and where codes can be sent. 


I would like to understand why the SSA has failed to make progress in addressing the OIG’s 
concerns and what the agency’s plan is to do so, including timelines and milestones. 


The mySocialSecurity portal provides access to some of Americans' most sensitive information 
including Social Security numbers, dates of birth, and earnings information, and Americans 
deserve to have this information protected. 


Congress of the United States 

H.£. House of Ueprcsentanocs 

COMMITTEE ON WAYS AND MEANS 

1102 Longworth House Office Building 
(202) 225-3625 

Washington, ©£ 20515—6348 

http:,, waysandmeans.house.gov 


RICH RD E. NEAL, MASSACHUSETTS. RANKING MEMBER 

SANDER M. LEVIN, MICHIGAN 

JOHN LEWIS. GEORGIA 

LLOYD DOGGETT, TEXAS 

MIKE THOMPSON, CALIFORNIA 

JOHN B. LARSON. CONNECTICUT 

EARL BLUMENAUER, OREGON 

RON KIND, WISCONSIN 

BILL PASCRELL, JR„ NEW JERSEY 

JOSEPH CROWLEY, NEW YORK 

DANNY K. DA . IS, ILLINOIS 

LINDA S NCHEZ, CALIFORNIA 

BRIAN HIGGINS. NEW YORK 

TERRI SEWELL, ALABAMA 

SUZAN DelBENE, WASHINGTON 

JUDY CHU, CALIFORNIA 


BRANDON CASEY, 

MINORITY CHIEF OF STAFF 


June 9, 2017 




Thank you for your attention to this matter and I look forward to seeing your response as soon as 
possible. If you have any questions concerning this request, please contact Amy Shuart, the 
Social Security Subcommittee Staff Director, at (202) 225-9263. 


Sincerely, 





Sam Johnson 
Chairman 

Subcommittee on Social Security 



♦y 


COMMITTEE ON WAYS AND MEANS 

U.S. HOUSE OF REPRESENTATIVES 

WASHINGTON, DC 20515-6348 


COMMITTEE ON WAYS AND MEANS 


U.S. HOUSE OF REPRESENTATIVES 
WASHINGTON, DC 20515 


August 2, 2016 


The Honorable Carolyn Colvin 
Acting Commissioner 
Social Security Administration 
6401 Security Boulevard 
Baltimore, MD 21235 

Dear Acting Commissioner Colvin: 

The Social Security Administration (SSA) houses sensitive data on nearly every American, 
including date of birth. Social Security Number, and earnings history. Americans rightly expect 
that their information is kept safe - whether it’s stored in databases or accessed through a website. 

To better protect taxpayers, the SSA is requiring individuals who have a mySocialSecurity account 
to receive a one-time code on their cellphone to be able to log in. While we need to make sure that 
taxpayers’ information is safe on the SSA’s website, this security has to work for more than just 
some people. 

The mySocialSecurity portal allows individuals to change their address and direct deposit 
information, get proof of their benefits, and a copy of the Social Security Statement. These 
important services help individuals get what they need from the SSA without having to wait in line 
at a field office. While well intentioned, the new process cuts off access to mySocialSecurity for 
those who do not have a cell phone. And worse, even if a person does have a cell phone, the new 
system may not work. It is troubling that individuals who use a major carrier like Verizon weren’t 
able to access mySocialSecurity when this new process was first rolled out. 

The SSA must make other options available so that individuals without a cell phone can continue to 
use mySocialSecurity , and do so in a way that keeps their information safe. I urge you to take a 
hard look at this new policy and make the changes necessary to ensure that mySocialSecurity has 
the right balance between security and access. I ask that you respond to this letter by August 9, 
2016. The American public deserves no less. 


Sincerelv. 



Sam Johnson 
Chairman 

Subcommittee on Social Security 



From: 

Cocke, Perry 


Sent: 

Wednesday, December 21, 2016 2:44 PM 


To: 

Hansen, Erik 


Cc: 

S®) ( 2 ) 


Subject: 

Due 12/23/16 - OITEBS Controls 2016 #0435 MFA 2.0 
Agreement - AC signoff 

Screen Packages and Release 

Attachments: 

Revised_ROME_MFA_Screen_Package_12052016.docx; 
12052016.docx; 13248211 RAVI 2.docx 

RCS_Screen_Package_ 

Follow Up Flag: 

Follow up 


Flag Status: 

Flagged 



Erik, 



....Perry 


(b) (6) 


From: Cocke, Perry 

Sent: Thursday, December 15, 2016 8:28 AM 


(b) (2) 


Subject: FW: Due 12/23/16 - OITEBS Controls 2016 #0435 MFA 2.0 Screen Packages and Release Agreement - AC signoff 


(b) (6) 


1 











Please work with 

clearance. 

Thanks. 


(b) (6) 


to review, prepare a brief summary, and prepare for 


....Perry 


(b)(6) 



Subject: Due 12/23/16 - OITEBS Controls 2016 #0435 MFA 2.0 Screen Packages and Release Agreement - AC signoff 


Revised. When you response to 
12/14/16) 


(b) (2) 


please cc 


(b) (2) 


to close. Thank you (vjb 


(b) (2) 


Sent: Wednesday, December 14, 2016 6:47 AM 


tm>) (2) 



(b) (2) 



HS<b) («) 



|(b)(6) 

(b) (2) 



Subject: Due 12/23/16 - OITEBS Controls 2016 #0435 MFA 2.0 Screen Packages and Release Agreement - AC signoff 


PLEASE RESPOND TO A OITBS ENTERPRISE Controls BY COB Friday. December 23. 2016 

Attached for your component’s management review and approval is Release Agreement (RA) and Screen 
packages for the MFA 2.0 project. The document has been reviewed and approved at the staff level as well 
as by the OITEBS management. 

Please forward approvals/non-approvals or comments to 

If approval is not received within the specified timeframe, the SPM will delete the 7s/”, annotate “No 
Response Received” on the respective individual’s signature line, and document it as a risk in IMT. 

If there are issues/disagreements about content that cannot be resolved timely, the SPM will make a 
recommendation to his/her AC to proceed without approval or to resolve issues/disagreements before 
proceeding. If the AC decision is to proceed without an approval, the SPM will delete the 7s/”, annotate 
“Does Not Concur” on the respective individual’s signature line, and document it as a risk in IMT. 


(b) (2) 


2 















Thank you, 


(b) (2) 


3 








Subject: Due 10/25/16 - ACTION: OITEBS Controls 2016 #0341 AC Approvals: Release Agreement (RA) for the MFA 2.0 
project 


PLEASE RESPOND TO 


(b) (2) 


BY COB Tuesday, October 25, 2016 


Attached for your component’s management review and approval is Release Agreement (RA) for the MFA 
2.0 project. The document has been reviewed and approved at the staff level as well as by the OITEBS 
management. 

Please forward approvals/non-approvals or comments to 


(b) (2) 


There is a two-week due date for sign-off . If approval is not received within the two-week timeframe, the 
SPM will delete the 7s/”, annotate “No Response Received” on the respective individual’s signature line, 
and document it as a risk in IMT. 


If there are issues/disagreements about content that cannot be resolved timely, the SPM will make a 
recommendation to his/her AC to proceed without approval or to resolve issues/disagreements before 
proceeding. If the AC decision is to proceed without an approval, the SPM will delete the “Is/”, annotate 
“Does Not Concur” on the respective individual’s signature line, and document it as a risk in IMT. 

Thank you. 


[(b)(2) 


3 









(b) (6) 


From: 

Sent: 

To: 

Cc: 

Subject: 


(b) (6) 


Monday, August 01, 2016 8:50 AM 
Hansen, Erik 
Chesser, Judyj 

FW: New step to protect your privacy using my Social Security 


(b) (6) 


Erik - here’s the context for my question. Any insight you can provide will be helpful. Thanks, 


(b) (6) 


(b) (6) 


From:[ 

Sent: Friday, July 29, 2016 4:08 PM 
To: 

Cc:| 

Subject: FW: New step to protect your privacy using my Social Security 


(b) (6) 


Hi 


(b) (6) 


We received a voicemail this afternoon from^^^^^J an Oregon constituent, regarding the below email 
requiring a cell phone numberandtheabilitytoreceive text messages in order to access “my Social Security” 

accounts (effective Monday).do not have access to text messaging and are concerned that 

they will no longer be able to access Medicare benefit and payment information online through then “my Social 
Seciuity” accounts. 


I reached out to CMS, but they correctly pointed out that t he email c ame from SSA — not CMS or HHS. Would 
you be able to reach out to your contacts at SSA regarding concerns? 

I'll forward his voicemail in my next email. I already spoke to^^^f this afternoon (so I don't think you need 
to call him back right away), but he would appreciate an update next week. I’ll also copy you on my reply to the 
below email. 


Thanks, and have a great weekend! 


(b) (6) 


Sent: Friday, July 29, 2016 3:22 PM 


(b) (6) 


Subject: Fwd: New step to protect your privacy using my Social Seciuity 


From: "Social Seciuity Ad mini stration" <subscription.service@subscriptions.ssa.gov> 
Sent: Thursday, July 28, 2016 11:45:59 PM 

Subject: New step to protect your privacy using my Social Seciuity 


t 




















Securing todav 
and tomorrov 


With you through life’s journey... 


Stalling in August 2016, Social Security is adding a new step to protect your privacy as a my 
Social Security user. This uew requirement is the result of an executive order for federal 
agencies to provide more secure authentication for their online seivices. Any agency that 
provides online access to a customer’s personal information must use multifactor 
authentication. 

When you sign in at ssa. gov invaccount with your username and password, we will ask you 
to add your text-enabled cell phone number. The purpose of providing your cell phone 
number is that, each time you log in to your account with your username and password, we 
will send you a one-time security code you must also enter to log in successfully to your 
accoimt. 

Each time you sign into your account, you will complete two steps: 


• Step 1: Enter your username and password. 

• Step 2: Enter the seciuity code we text to your cell phone (cell phone provider's text 
message and data rates may apply). 


The process of using a one-time secmity code in addition to a username and password is one 
form of “multifactor authentication,” which means we are using more than one method to 
make sure you are the actual owner of your accoimt. 

If you do not have a text-enabled cell phone or you do not wish to provide your cell phone 
number, you will not be able to access your my Social Secmity accoimt. 

If you are unable or choose not to use my Social Secmity, there are other ways you can 
contact us . To learn more, please review the Frequently Asked Questions found here . 


Stay Connected with the Social Secmity: 





SUBSCRIBER SERVICES: 

Manage Subscriptions | Unsubscribe All | Help 


This email was sent to 


(b) (6) 


by the Social Secmity Administration, and 


was produced and disseminated at U.S. taxpayer expense. 
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##020 P.002/005 


Snyde^Rebecca 

From: 

Sent: 

To: 

Subject: 

Attachments: 


Snyder, Rebecca 

Monday, August 01, 2016 12:45 PM 


(b) (6) 


Executive Order 13681 
SSA.pdf 


Importance: 


High 


Good Afternoon, 

Congressman Heck is receiving communications from his constituents who received a recent email regarding SSA's 
compliance with Executive Order (EO) 13681 which directed " federal agencies to provide more secure authentication of 
online services. Any agency that provides online access to a customer's personal information must use multifactor 
authentication". 

The SSA chose to execute this order was to inform ssa.gov users to add their text-enabled cell phone number. A number 
of concerns has been raised with this decision. 

1. Not all cell phones are text enabled 

2. Many seniors do not use or a unable or unfamiliar with text. 

3. The perception text messaging is inherently unsecure and open to hacking/interception 

4. There is now an cost to the user as text/data rates apply 

5. Why is notification within days of the execution of the plan? 

In order to respond to his constituents. Congressman Heck would like to know; 

1. How did SSA determine this would be the most effective/secure method to comply with the EO? Please provide 
copies of any reports/surveys taken. 

2. Was there any input from SSA beneficiaries? 

3. Was multifactor authentication considered for email accounts or any other method which many seniors find 
more secure? 

We did not attach Privacy Release Forms as our office does not require any personal information; rather this inquiry is 
purely of a policy nature. 

Your swift review and response is appreciated. 


Rebecca Snyder 

Lead Caseworker/Academy Coordinator 
Congressman Denny Heck 
420 College Street SE, Suite 3000 
Lacey, WA 98503 
360-459-8514 Lacey Office phone 
360-459-8581 Lacey Office fax 
253-722-5860 Tacoma Office phone 

Sign up for Denny's e-newsletter 


l 





From O f tico of Rep. Denny Hock 


3604S9Q581 


08/02/2016 OOrbO 


k uu^/uuo 


Srr^derRebecca 


From: 

Sent: 

To: 

Subject: 



Monday, August 01, 201612:16 PM 
Snyder, Rebecca 
SSA Announcement 


Rebecca, 


This is the announcement from SSA that we're referring to over the phone. 

Official Social Security Administration announcement regarding the required use of text messaging for account 
access 

https://www.ssa.gov/mvaccount/MorelnformationAboutMFA.html 

Executive Order 13681 

(October 17, 2014) 

See "Section 3: Securing Federal Transactions Online" 




This information is intended only for the congressional addressee or other individual to whom it is addressed and may contain confidents I and/or 
privileged material. Any review, retransmission, dissemination or other use of this information is only at the discretion of the Intended recipient. If 
you received this in error, please contact the sender and delete the material from any computer. 
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Message 
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Headers | 


(b) (6) 


Date: 7/29/2016 6:29:34 PM 

To: "member@aarp.org" <member@aarp.org>, "Senator@murray.senate.gov" 
<Senator@murray.senate.gov>, "Denny Heck" <WA10DHIMA@mail.house.gov> 
Cc: 

Subject: Re: SSA's Over Strict Access Policy 


HTML 


Whoever Can Help; 

] received the attached email from SSA concerning my "my Social Security' 
account which states that they will make it impossible for me to access my 
account online. They state that I "MUST" be able to accept text messages 
via my mobile phone. I do not have a smart phone, my cell does not accept 
text messages, and 1 do not and cannot afford a new phone or the cost of 
getting text messages. Also, text messaging is inherently unsecure and open 
to hacking and interception. 

My bank uses a similar process but sends the one-time pin to my email 
address which is a pain but works well. People get their email on their 
cell phones so why is it that we must pay this extra amount because these 
morons want to use "text messaging" instead of an email address that 
everyone has and can get at home or on their cell. This SSA policy is 
supposed to start August 2016.1 received a whole 3 days' notice. What 
kind of crap is this. No input from anyone about a change that is probably 
going to affect millions of seniors who will no longer be able to get to 
their "my Social Security" accounts. 

Can someone at AARP/Congress/House contact someone or do something to stop 
this policy change that w r as obviously thought up by someone in a very dark 
basement enjoying cannabis cookies. 

Thank you for your time and any assistance that you can give concerning this 
very critical matter. 

V/R 


(b) (6) 


[~Close "I 


https://lmiq001.us.house.gov/IQl/view_eml 2.aspx?rid^8081498&.oid-387483&did=&fro... 8/1/2016 
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Email Viewer 


Message Details 


Attachments ]j Headers | Source j 


HTML 



Date: 7/29/2016 2:38:12 PM 

To: "Representative Denny Heck" <WA10DHIMA@mail.house.gov> 
Cc: 

Subject: Re: Responding to your message 


Rebecca 

Per our telecon, attached is the email received from Social Security concerning their requirement to 
have a text-enabled cell phone in order to access my Social Security. 

1) Please verify whether this is a legitimate email (i.e. that it came from Social Security). 

2) If it is from Social Security, I need to express a complaint. I do not use text messaging, nor do 1 
plan to. It would seem they could respond to my email address in lieu of a text message and not lock 
me out of access to my account. 

Cyber security is a concern, but this single methodology of supplying a code is not appropriate or 
convenient. Thank you. 


(b) (6) 


On Jul 29, 2016, at 10:29 AM, Denny Heck 

<WA10DHIMA@mail.house.gov<mailto:WAl ODHIMA@mail.house.gov» wrote: 
<https://iqconnect.Imhostediq.com/iqextranet/iqClickTrk.aspx? 

&cid=WA 1 ODH&crop-l 4187.8065855.5203981.7153405&report _id=&redirect=http%3a%2f% 
2fhouse.gov%2f&redir_log=913103559399117> 

[http://www.intranetquomm.eom/sites/default/files/l Bthcongressimages/congress banner seal.png] 
July 29, 2016 
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Thank you for contacting the office of Congressman Denny Heck regarding your concern with a 
Social Security Administration (SSA) notification. Please respond to this email with a copy of the 
information you received. 


https://lmiq001.us.house.gov/iql/view eml_2.aspx?rid=8065885&oid-=387465&did- &from... 8/1/2016 
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Subject: 


Changes to mySocialSecurity 


From: Jochimsen, Stacey (Merkley) < Stacev Jochimsen(arnerklev.senate.aov > 

Sent: Friday, July 29, 2016 16:20 

To: Forrester, Robert 

Subject: Changes to mySocialSecurity 

Good afternoon, Robert. 

We have been receiving a number of letters from concerned constituents regarding changes to mySocialSecurity.gov's 
security policy. A constituent forwarded me an email (and I received the same email in my personal inbox) indicating 
that if you do not have a text-enabled cell phone or do not wish to provide your cell phone number, you will NOT be able 
to access your my Social Security account. 

The website indicates that they offer the choice to use increased security measures, including a unique code to be sent 
to one's cell phone. 

Can you please advise as to whether, moving forward, an individual must provide a text-enabled cell phone number to 
access mySocialSecurity.gov? 

Kindly, 

Stacey jochimsen, MPH 

Constituent Services Representative 

Office of Senator Jeff Merkley 

121 SW Salmon St., Ste. 1400 Portland, OR 97204-2948 

Phone: 503-326-3386 

Stacey Tochimsensmerklev. senate, gov 

Sign uv for Senator Merkley''s E-newsletter 

Become a Supporter on Facebook 

Follow Jeff on Twitter 
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